feat: Add support for rootless Podman execution #288

New Issue

MrUnknownDE · 2026-04-05T17:05:08+02:00

MrUnknownDE commented

2026-04-05 17:05:08 +02:00

Originally created by @arousalspoon204 on 2/2/2026

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

This PR introduces support for running the Pangolin stack in rootless Podman mode and allows users to configure custom HTTP/HTTPS ports during installation.

Key Changes:

Rootless Support: Added detection for rootless environments and adjusted container capabilities (conditionally disabling SYS_MODULE when rootless).
Configurable Ports: Users can now specify HTTP and HTTPS ports during the installation process, which are then correctly applied to the `docker-compose.yml
Host Prerequisite Checks: The installer now proactively checks for:
- IP Forwarding (required for VPN routing).
- wireguard kernel module (required on the host for rootless Gerbil).
- /dev/net/tun access permissions.
- Unprivileged port configuration (ip_unprivileged_port_start) for Podman.
UX Improvements: Added sudo-integration for host configuration tasks if the installer is run as a non-root user.

These changes make Pangolin more flexible for deployment on systems where root access is restricted or where standard ports (80/443) are already in use.

How to test?

Run as non-root: Execute the installer without sudo: go run install/main.go
Select Podman: Choose Podman when prompted.
Test Ports (Two Scenarios):
- Scenario A (Standard Ports): Enter 80 / 443. Verify that the installer detects this and asks to configure net.ipv4.ip_unprivileged_port_start so
  Podman can bind these low ports.
- Scenario B (Custom Ports): Enter 8080 / 8443. Verify that the generated docker-compose.yml uses these ports instead of the defaults.
Verify Compose: Check the generated docker-compose.yml to ensure SYS_MODULE is omitted in rootless mode.

*Originally created by @arousalspoon204 on 2/2/2026* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description This PR introduces support for running the Pangolin stack in rootless Podman mode and allows users to configure custom HTTP/HTTPS ports during installation. ### Key Changes: * **Rootless Support:** Added detection for rootless environments and adjusted container capabilities (conditionally disabling `SYS_MODULE` when rootless). * **Configurable Ports:** Users can now specify HTTP and HTTPS ports during the installation process, which are then correctly applied to the `docker-compose.yml * **Host Prerequisite Checks:** The installer now proactively checks for: * IP Forwarding (required for VPN routing). * `wireguard` kernel module (required on the host for rootless Gerbil). * `/dev/net/tun` access permissions. * Unprivileged port configuration (`ip_unprivileged_port_start`) for Podman. * **UX Improvements:** Added sudo-integration for host configuration tasks if the installer is run as a non-root user. These changes make Pangolin more flexible for deployment on systems where root access is restricted or where standard ports (80/443) are already in use. ## How to test? 1. **Run as non-root:** Execute the installer without sudo: `go run install/main.go` 2. **Select Podman:** Choose Podman when prompted. 3. **Test Ports (Two Scenarios):** * **Scenario A (Standard Ports):** Enter `80` / `443`. Verify that the installer detects this and asks to configure `net.ipv4.ip_unprivileged_port_start` so Podman can bind these low ports. * **Scenario B (Custom Ports):** Enter `8080` / `8443`. Verify that the generated `docker-compose.yml` uses these ports instead of the defaults. 4. **Verify Compose:** Check the generated `docker-compose.yml` to ensure `SYS_MODULE` is omitted in rootless mode.

MrUnknownDE closed this issue

2026-04-05 17:05:08 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#288